PT-2026-81129 · Adminer · Adminerfileupload+1

Riodrwn

·

CVE-2026-56702

·

Published

2026-07-09

·

Updated

2026-08-25

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Adminer versions prior to 5.4.3
Description The AdminerFileUpload plugin allows authenticated users to upload PHP files due to a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute arbitrary code as the web-server user when uploadPath is web-served.
Recommendations Update to version 5.4.3 or later.

Exploit

Fix

Unrestricted File Upload

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2026-12786
CVE-2026-56702
GHSA-VCVJ-RWWM-X6G5

Affected Products

Adminer
Adminerfileupload